getculpa 1.0.7 → 1.0.10

package/lib/provision.mjs

@@ -17,7 +17,8 @@ import { spawnSync as realSpawnSync } from "node:child_process";
 import { copyFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { checkDockerEngineReachable, checkDockerPresent, classifyUpgrade, isIncomingComposeOlder } from "./preflight.mjs";
+import { checkDockerEngineReachable, checkDockerPresent, classifyUpgrade, isComposeUpgrade, isIncomingComposeOlder, versionSkew } from "./preflight.mjs";
+import { runningImageVersions } from "./docker.mjs";
 import { resolveAssetPath } from "./assets.mjs";
 import { canonicalAppDir } from "./paths.mjs";
 
@@ -111,9 +112,14 @@ export function stageParityFiles(appDir, env = process.env, platform = process.p
   copyFileSync(resolveAssetPath(RELAY_FLY_CONFIG), path.join(appDir, RELAY_FLY_CONFIG));
 }
 
-// The live compose is staged ONLY when absent. An existing live compose
-// belongs to launch-time's QW-1 sync (launch-culpa.ps1) — provisioning must
-// never re-pin a running install out from under it.
+// The live compose is staged when absent; when PRESENT it is re-pinned here
+// by the same QW-1 one-direction rule launch uses (T-178, ISS-MAC-7). The
+// earlier rule ("provisioning must never re-pin a running install out from
+// under it") answered a fear that a re-pinned file changes a running stack —
+// it does not: nothing moves until the next `compose up`, which both
+// launchers now run behind QW-3/QW-4 even on a running stack (ISS-V103-7).
+// A refused downgrade never reaches here with a newer shipped file (the
+// re-stage was skipped), and isComposeUpgrade refuses an older one anyway.
 export function stageLiveComposeIfAbsent(appDir) {
   const live = path.join(appDir, "docker-compose.yml");
   if (existsSync(live)) return false;
@@ -121,6 +127,29 @@ export function stageLiveComposeIfAbsent(appDir) {
   return true;
 }
 
+export function repinLiveCompose(appDir) {
+  const shipped = path.join(appDir, "culpa-compose.yml");
+  const live = path.join(appDir, "docker-compose.yml");
+  if (!existsSync(shipped) || !existsSync(live)) return false;
+  if (!isComposeUpgrade(readFileSync(shipped, "utf8"), readFileSync(live, "utf8"), (m) => console.warn(m))) return false;
+  copyFileSync(shipped, live);
+  console.log("getculpa: upgrade detected - live compose re-pinned from the shipped culpa-compose.yml (applies at next `getculpa`).");
+  return true;
+}
+
+// T-178: what the stack is ACTUALLY running, recorded in install-state.json
+// beside the staging facts — imagesStaged says what was pulled, not what runs.
+function probeLiveStack({ appDir, dockerState, dockerSpawnSync }) {
+  if (dockerState !== "ready") return { probed: false, running: false, versions: {}, skew: null };
+  const versions = runningImageVersions(dockerSpawnSync);
+  const read = (name) => {
+    const p = path.join(appDir, name);
+    return existsSync(p) ? readFileSync(p, "utf8") : "";
+  };
+  const skew = versionSkew({ shippedText: read("culpa-compose.yml"), liveText: read("docker-compose.yml"), running: versions });
+  return { probed: true, running: Object.keys(versions).length > 0, versions, skew };
+}
+
 // T-CF29-8 — the name culpa-collector.ps1:35 reads from the app dir, and the
 // same name culpa-setup.iss:52 installs there. NOT the Rust target triple
 // lib/fetch.mjs uses for the release asset (x86_64-pc-windows-msvc): this is
@@ -260,6 +289,7 @@ export async function provision(opts) {
     stageParityFiles(appDir, env, platform);
   }
   stageLiveComposeIfAbsent(appDir);
+  if (!refusedDowngrade) repinLiveCompose(appDir);
 
   // T-CF29-8: only attempt it when the fetch reported success; the result is
   // what gets recorded, not the intent.
@@ -282,6 +312,15 @@ export async function provision(opts) {
     console.warn(`getculpa: ${why} - image staging deferred to first \`getculpa\`.`);
   }
 
+  // T-178 (ISS-MAC-7): say plainly what is running and what the next launch
+  // will do — a reinstall over a running stack used to look finished.
+  const liveStack = probeLiveStack({ appDir, dockerState, dockerSpawnSync });
+  if (liveStack.running && liveStack.skew !== null) {
+    console.warn(
+      `getculpa: Culpa is running on ${liveStack.skew.from}; the next \`getculpa\` will pull ${liveStack.skew.to} and migrate (a database backup is taken first).`,
+    );
+  }
+
   if (platform === "win32") {
     // CF20-R: the Windows delegate registers the ONE fixed, per-machine HKCU
     // uninstall key (install-culpa.ps1 / culpa-setup.iss's AppId). A second
@@ -317,6 +356,9 @@ export async function provision(opts) {
     dockerState,
     imagesStaged,
     collectorStaged,
+    // T-178: the live docker state at provision time (what RUNS), distinct
+    // from imagesStaged (what was pulled)
+    liveStack,
     platform,
   });
 
@@ -325,5 +367,5 @@ export async function provision(opts) {
   // (scripts/install.js) could not see them — which is how a Docker-less
   // install still printed "Culpa installed successfully." Returning them
   // changes no behavior here; it just stops postinstall from having to guess.
-  return { classification, previousVersion, dockerState, imagesStaged, collectorStaged };
+  return { classification, previousVersion, dockerState, imagesStaged, collectorStaged, liveStack };
 }